EU General Data Protection Regulation: Changes and implications for personal data collecting companies

The General Data Protection Regulation (GDPR), enacted in the European Union in 2018, has significantly transformed the landscape of personal data management and protection. This article provides an overview of GDPR's impact, focusing on its applicability, fundamental principles and influence on data management practices, particularly within the European Society of Thoracic Surgeons (ESTS) database. GDPR's reach extends to all entities collecting and processing personal data of European Union residents, regardless of their location. It encompasses various data types, emphasizing meticulous handling and protection of identifiable information. Special categories of data, such as health and sensitive attributes, require even more stringent protection. The regulation sets legal, fair and transparent data processing principles, emphasizing accuracy, purpose limitation and data minimization. It also stresses accountability, leading to the appointment of Data Protection Officers and significant penalties for non-compliance. The ESTS database, designed to enhance thoracic surgical research and care, collects data on European procedures. It follows GDPR principles by pseudonymizing data, ensuring secure data transmission and providing clear instructions for data submission. The database contributes to research, policymaking and practice improvement in thoracic surgery by offering a comprehensive dataset for analysis. Here, we aim to shed light on the complexities of GDPR implementation and emphasize the need for comprehensive data management strategies to ensure compliance and enhance privacy protection with the contribution to the ESTS database. GDPR compliance comes with challenges, including potential human dignity and privacy rights violations. Data breaches can result in unauthorized disclosures, and non-compliance can lead to substantial fines and reputational damage. The implementation of GDPR encourages organizations to prioritize ethical data practices, security measures and transparent data handling. In conclusion, GDPR has revolutionized personal data protection by emphasizing accountability, transparency and individual rights. It has impacted organizations globally, promoting responsible data management practices. Adhering to GDPR ensures privacy protection, trust-building and overall enhancement of data management in today's data-driven environment.

Data breaches inevitably happen. Information gets lost, stolen or otherwise released into the hands of people who were never intended to see it - and those people often have malicious intent. The GDPR (General Data Protection Regulation) is legislation for data protection and privacy of the residents of the European Union (EU) that replaced the previously existing Data Protection Directive 95/46/EC in spring 2018 as the primary law regulating on how companies protect EU citizens’ personal data. Under the terms of GDPR, not only do organisations have to ensure that personal data is gathered legally and under strict conditions, but those who collect and manage it are obliged to protect it from misuse and exploitation, as well as to respect the rights of data owners - or face penalties for not doing so. The GDPR's goal is to impose a uniform data security regulation on all EU members, removing the need for each member state to design their own data protection rules and ensuring that laws are consistent across the EU. The present paper discusses in brief the overview of GDPR, its provisions, penalties for non-compliance and many such queries which we generally have regarding this data protection regulation.

The processing of personal data is becoming a key business factor, especially for high-tech system industries such as automotive and healthcare service providers. To protect such data, the European Union (EU) has introduced the General Data Protection Regulation (GDPR), with the aim to standardize and strengthen data protection policies across EU countries. The GDPR defines stringent requirements on the collection and processing of personal data and imposes severe fines and penalties on data controllers and processors for non-compliance. Although the GDPR is enforce since 2018, many public and private organizations are still struggling to fully comply with the regulation. A main reason for this is the lack of usable methodologies that can support developers in designing of GDPR-complaint high-tech systems. This paper examines the growing literature on methodologies for the design of privacy-aware systems, and identifies the main challenges to be addressed in order to facilitate developers in the design of such systems. In particular, we investigate to what extent existing methodologies (i) cover GDPR and privacy-by-design principles, (ii) address different levels of system design concerns, and (iii) have demonstrated their suitability for the purpose. Our literature study shows that the domain landscape appears to be heterogeneous and disconnected, as existing methodologies often focus only on subsets of the GDPR principles and/or on specific angles of system design. Based on our findings, we provide recommendations on the definition of comprehensive methodologies tailored to designing GDPR-compliant high-tech systems.

Over Troubled Water: E-Health Platforms and the Protection of Personal Data: The Case of Portugal

INTRODUCTION This chapter introduces the European approach to privacy and data protection. Two things are important to point out from the start. First, there are differences between the right to privacy and the right to data protection, which will be described in more detail below. Perhaps the most prominent difference lies in the material scope. The right to privacy usually does not extend to the collection of nonprivate and non-privacy-sensitive data, whereas the term ‘personal data’, central to most data protection documents, is not limited to private or sensitive information, but extents to any data with which someone could potentially be identified. ‘Even ancillary information, such as “the man wearing a black suit” may identify someone out of the passers-by standing at a traffic light. ’Second, this study will primarily discuss the European perspective and in doing so will refer to documents of both the European Union (EU) and the Council of Europe (CoE). For privacy, the case law by the European Court of Human Rights (ECtHR) on Article 8 of the European Convention on Human Rights (ECHR) will be central and with regard to data protection, the EU's Data Protection Directive and the General Data Protection Regulation, which will replace the Directive over time, will function as the primary (though not exclusive) points of reference. Article 8 ECHR grants a right to respect for private and family life, home and correspondence: 1. Everyone has the right to respect for his private and family life, his home and his correspondence. 2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic wellbeing of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others. The right to data protection is currently protected by the Data Protection Directive, which contains rules for data controllers such as: store data only when necessary, store data safely, process personal data with a legitimate aim, be transparent about the processing activities, etc. It also contains some rights for data subjects, such as the right to have access to personal data, to correct inaccurate data and to object to certain types of data processing.

The Court of Justice of the European Union (CJEU) plays an essential role as the supreme interpreter of primary and secondary European law. Since its inception, the CJEU adopted four methods of interpretation — grammatical, contextual, historical and teleological — and often used all of them to clarify a provision in question. For many reasons, the teleological method is often avoided or misunderstood by many. Regardless of personal opinions, however, the teleological method’s significant impact on the legal interpretation of European Union (EU) legislation must be acknowledged. Rightly or not, the majority of interested parties perceive the provisions of the General Data Protection Regulation (GDPR) as ambiguous. The EU’s 24 official languages hinder the use of the grammatical method of interpretation as the primary and absolute one. The contextual and historical methods are often inconclusive. Consequently, the teleological method of legal interpretation, focusing on the goals and objectives of the legislation, allows the CJEU to adjudicate coherently with the whole EU legal system and its objectives. Recognising that the goals and objectives are part of the GDPR complements the grammatical, contextual and historical interpretation methods and help see the regulation in its intended light: a legal framework for personal data processing, which respects everyone’s fundamental right to personal data protection, aiming to balance it with other fundamental rights. This paper aims to draw attention to the often forgotten or only reluctantly applied teleological interpretation method in implementing the GDPR.

Currently, South Korea s data protection law can be characterized as a rigid protection system focused on criminal punishment based on prior consent of data subject. It is known as the world s most powerful and strict regulatory legislation. Compared to the European Union s General Data Protection Regulation(GDPR), Korea s data protection law is considered one of the strictest privacy regulations in the world. Many say that the current protection model in Korea has lost its balance of protection and utilization. It requires prior consent of the data subject in order to collect, use, and provide personal data on the premise that personal data must be protected like a private secret. And it imposes excessive administrative fines and criminal penalties for violations. This article was written with the aim of providing clues as to how Korea s data protection law should find a reasonable balance between protection and use in the future. Fortunately, the Personal Data Protection Act, which was revised in February 2020, can be positively evaluated as a legislative attempt to find a reasonable balance between protection and utilization. Similar to the European Union s GDPR, the revised law permits the change of purpose to the extent reasonably related to the purpose of collection. And it introduced the concept of pseudonymized data to increase the possibility of using pseudonymized data, and integrated the enforcement system into the Personal Data Protection Committee to secure the expertise and independence of the data protection agency. This can be assessed as a step closer to global standards. Nevertheless, Korea s data protection law still has a rigid protection model from the perspective of global standards. This article presents three urgent legislative tasks to be improved. First, as in the European Union s GDPR, the six grounds of lawfulness for collection, use, and provision of personal data must be acknowledged, and in principle, the same grounds must be applied in the field of information and communications networks. Second, the requirements for the exercise of the right to the protection of personal data, reasons for defense, and exceptions must be prepared in a reasonable manner. Third, excessive criminal punishment should be reorganized. Like Germany or the UK, criminal sanctions should be imposed only for serious violations of the law, or, as in Japan, criminal sanctions should be imposed for violations of corrective orders of the Personal Data Protection Committee.

Every provider of electronic services in the Republic of Croatia as well as in the European union, including healthcare services providers, is exposed to the risk of data and information disclosure on a daily basis. In accordance with the General Data Protection Regulation and the Law on Data and Information in Health of the Republic of Croatia, they must implement technical and organizational measures to increase the level of data protection. The author in this paper emphasizes the methodology of security and data protection and liability in risk management in health information systems by applying international standards, ISO 27799: 2016 in particular in accordance with the applicable legal framework in the field of protection of personal data and information in health care, which ensures a high level of protection, with a clear identification of the liability of supervisory entities in the management of data and information in health care.

On May 25th, 2018, the EU General Data Protection Regulation (GDPR) came into force. Recognised as a comprehensive regulation for improving privacy and data protection, a substantial impact on data processing disciplines such as Serious Games (SG) research was expected.By conducting a scoping review, this paper explores the effects of GDPR on reporting of ethics approval, informed consent, ethics guidelines and data protection in SG studies. Five scientific databases were searched for research between 2016 and 2020 addressing Serious Games, Exergames and Applied Games. A total of 2146 full-text studies split into equal collections before and after GDPR were included. Lexicometric and keyword-in-context analysis were conducted and comparatively evaluated regarding ethics reporting and trends.Results unexpectedly show that GDPR so far hardly left a mark. While a slight increase of 12% in general ethics reporting can be observed, less than 6% of the studies after GDPR coming-into-force report on data protection. Ethics procedures remained consistent with most researchers reporting the approval from their home university committee and stating the Declaration of Helsinki as followed guidelines. Overall, the verifiable impact of GDPR was found negligibly small, with only 0.5% of studies referring to the regulation in the two years after introduction. Conclusively, further research is suggested to focus on integrating ethics and data protection guided on GDPR from an early conceptual stage to the reporting of the findings.

This paper analyzes the importance of Indonesia's comprehensive legal framework on automated decision-making empowered by Artificial Intelligence, comparing it to the European Union, the United States, and China. Specifically, this paper inquires about the status quo of the legal protection of automated decision-making In Indonesia. The analysis highlights profiling in an automated decision-making system with the following discussion about personal data protection. In this context, the European Union's member states set out the General Data Protection Regulation (GDPR) that prohibits automated decision-making to a certain extent. In the United States, the practice of automated decision-making is rather usual. Simultaneously, China takes an exceptional measure instead and develops this automation through a social credit system. The analysis concludes that Indonesia has weak legal protection towards personal data and profiling, which later becomes the basis in facilitating automated decision-making. The provision of automated decision-making and profiling is the absolute bare minimum to Indonesia's Personal Data Protection Bill due to insufficient legal certainty. In the end, it is paramount for lawmakers to consider a comprehensive regulation on automated decision-making by adopting the European Union's GDPR framework.
 KEYWORDS: Artificial Intelligence, Automated Decision-Making, Personal Data Protection.

Design principles for the General Data Protection Regulation (GDPR): A formal concept analysis and its evaluation

The European General Data Protection Regulation (GDPR), which has been in effect since 25th May, 2018, tightens the requirements regarding data protection for anyone collecting or processing personal data within the European Union (EU) and is connected with heavy fines in case of violations. The topic of data privacy for cyber-physical systems and the related requirements towards development and operation are, however, not new. Many regional laws and regulations pursuing the goals of confidentiality, integrity, availability, storage and purpose limitation, minimisation, transparency and accuracy of personal data have already been in place long before the introduction of the GDPR. But for many companies, dealing with the formal requirements defined by the GDPR is a new and challenging task. We developed a clearly structured approach based on established and proven workflows aimed at integrating data protection topics into existing development processes and thereby achieving compliance with data protection regulations. This approach follows the widely used V-model for development and is inspired by concepts from functional safety development. Both the discipline of functional safety and that of data privacy aim to protect the end-user against harm caused by malfunctions of the system they are using. In the first case this refers to physical harm, while in the second to harm due to violations of fundamental rights and freedoms of natural persons. In the age of digitalisation there are currently indications for a paradigm shift that puts both kinds of harm on the same level. The approach starts by defining the scope of collection and processing of private data as well as the relevant functions and interfaces. Based on this, the threats related to the loss or breach of personal data are analysed and corresponding goals are formulated. A high-level strategy for reaching those goals and preventing data privacy infringements is then derived. This strategy is further refined into concrete technical and process solutions for which verification and validation criteria are defined.

BackgroundThe COVID-19 pandemic brought global disruption to health, society and economy, including to the conduct of clinical research. In the European Union (EU), the legal and ethical framework for research is complex and divergent. Many challenges exist in relation to the interplay of the various applicable rules, particularly with respect to compliance with the General Data Protection Regulation (GDPR). This study aimed to gain insights into the experience of key clinical research stakeholders [investigators, ethics committees (ECs), and data protection officers (DPOs)/legal experts working with clinical research sponsors] across the EU and the UK on the main challenges related to data protection in clinical research before and during the pandemic.Materials and methodsThe study consisted of an online survey and follow-up semi-structured interviews. Data collection occurred between April and December 2021. Survey data was analyzed descriptively, and the interviews underwent a framework analysis.Results and conclusionIn total, 191 respondents filled in the survey, of whom fourteen participated in the follow-up interviews. Out of the targeted 28 countries (EU and UK), 25 were represented in the survey. The majority of stakeholders were based in Western Europe. This study empirically elucidated numerous key legal and ethical issues related to GDPR compliance in the context of (cross-border) clinical research. It showed that the lack of legal harmonization remains the biggest challenge in the field, and that it is present not only at the level of the interplay of key EU legislative acts and national implementation of the GDPR, but also when it comes to interpretation at local, regional and institutional levels. Moreover, the role of ECs in data protection was further explored and possible ways forward for its normative delineation were discussed. According to the participants, the pandemic did not bring additional legal challenges. Although practical challenges (for instance, mainly related to the provision of information to patients) were high due to the globally enacted crisis measures, the key problematic issues on (cross-border) health research, interpretations of the legal texts and compliance strategies remained largely the same.

The authors of this work claim that the legislation of the European Union does not adequately protect biometric data, due to the actuality that the protection of biometric data after the death of a person is unresolved within the legal field of personal data protection. The General Data Protection Regulation (GDPR) does not apply to deceased individuals, meaning that biometric data that was processed under the GDPR during the individual's lifetime continues to be at risk of re-processing after the individual's death, meaning that businesses can potentially avoid GDPR when the person has died, and decide the fate of the deceased's biometrics at their own discretion. Taking into account the above, the authors of the work consider it necessary to orient special legislation to overcome the specified legal gap, and since the regulation on the protection of personal data is vague to solve the problem, the research proposal of the authors consists in the application of legal guarantees not only under the GDPR but also in conformity with civil law. Therefore, the authors aim to initiate provisions for potential legislation, including the consolidation of the processing of biometric data of the deceased as part of a person's last will. The development of legal norms that would protect the biometric data of deceased persons by classifying them as non-property rights is especially recommended for countries with a civil law system. The research paper also warns that privileges that belong to the non-property rights of an individual do not, as a rule, automatically pass to heirs. In this regard, in the absence of a person's will to decide the future fate of biometric data that is continuously processed at the time or after death, the authors offer to allow family members and other close persons to exercise the right to the protection of personal data, such as the right to be forgotten, on behalf of the deceased, and to demand the condition of appropriate technical and organizational guarantees in the event of such performance. In this matter, according to the authors, it is expedient to conclude agreements between interested parties and family members to determine the fate of biometric data. However, in order to avoid the realization of the right to the protection of personal data, which the deceased did not have time to realize during his lifetime, and if during the life of the person Article, 9 (2, a) GDPR confirmed as the basis for the permitted biometric data processing because it is subject to the consent of the person, then following the human-centric approach of the European Union, it is proposed to design and indicate in such consent a clause where the individual could specifically determine and decide the fate of the biometric data upon death, for example, to (i) delete, (ii) transfer for the research purposes. Consequently, the authors predict the development of legal regulation of biometric data by assigning it to the category of non-property rights. Hence, the adoption of special provisions for the protection of the deceased biometric data and ensuring the realization of the right to personal data protection is expected not only during life but also after death.

Case law regularly includes personal data on identifiable persons, often of a rather sensitive nature. This makes the EU General Data Protection Regulation (GDPR) relevant. However, the processing of personal data in case law has until recently not been questioned from the point of view of data protection of the individuals concerned. The Court of Justice of the European Union has taken steps ensure such protection for individuals appearing before the courts. Sweden has chosen another path. As transparency is a highly treasured in Sweden, including transparency in the judiciary, restricting access to the full verdict is sensitive. Instead, the processing of personal data has been restricted in a certain areas, such as research. In order to fulfill the requirements for an ‘appropriate safeguard’ under Article 89 GDPR, an ethical approval is needed for all research on specific categories of sensitive personal data, with no exception for publicly-available official documents like case law. The question posed is how the interest in protection of personal data retrieved from case law can be reconciled with the interest in transparency of the judicial process. It is concluded that even though requirements for an ethical approval of legal research hardly can be seen as a relevant ‘appropriate safeguard’, it cannot be denied that there is a legitimate interest of identifiable persons in case law to have their rights in personal data at least considered. Courts should therefore be stronger in elucidating when and why transparency is of overriding importance, and when and why data protection and the interest of secrecy should prevail. Data protection, transparency, case law, official documents, secrecy, sensitive data, research exception, appropriate safeguard, ethical approval